Author: Dan Gregory
What happens when the supply chain question shifts from the code you run to the content you consume? In the age of agentic AI where the mere act of reading content can trigger actions, the blast radius can be difficult to discern.
Where We Are
Let’s begin by setting the stage.
In the past year alone, we have responded to a string of supply chain threats that continue to mold the way we approach risk prioritization with limited resources and increasingly wearied (yet resilient) security teams. These attacks continue to be maddening in their simplicity as we are all repeatedly left saying: “What did we miss, and if we didn’t miss it, why did we not address these risks sooner?”
RedDirection and Dark Spectre (e.g.: Zoom Stealer) showed how legitimate, non-malicious tools can become subtle avenues of initial access. The Shai-Hulud campaigns reinforced how deeply interdependent open-source ecosystems are, where one compromise can ripple widely and take real effort to unwind. And the Notepad++ update hijack was a blunt reminder that fundamentals like signature and certificate validation still matter, no matter how widely-used the software is.
Where We Are Going
Enter agentic AI.
In one sense, the supply chain risks we’ve watched come to fruition apply here in much the same way. The core question is still deceptively simple: what is the provenance of every component and line of code?
Broadly, we can say with a high degree of certainty that agentic architectures inherit the same hazards: dependency confusion, compromised packages, and hijacked open-source components will remain reliable paths for attackers.
We can apply this mode of thought further to AI systems and view them with the same lenses we already have in a new setting: we need to understand model provenance the way we vet OSS, test models with the rigor we apply to new frameworks, and inventory AI systems (AI-BOMs) with the same discipline we’ve built around SBOMs.
So, these are just familiar risks with novel technical mechanisms to attack, right? Partially true, but agents introduce a materially different attack surface that deserves its own focus.
A New Focus (and Hope)
We have a new plane to worry about: content.
Specifically, when we talk about agentic AI supply chain risks, RAG, MCP servers, and other agent integrations significantly widen the scope. From well-known internal repositories to the entire surface of the internet, agents can use almost anything as a foundational input for their actions.
At first glance this may feel familiar: whether it be malicious code injected at build time, a hijacked CDN that serves malicious content, or IaC templates with insecure configurations.
However, this is tangibly different due to two reasons that provide for a much more potent risk landscape when combined.
First: content breadth. We must think about agentic AI differently due to the sheer breadth of content sources that can be used. If you build an agent with unfettered access to the open web, every single piece of content on the internet becomes a supply chain risk.
Second: agency. We are used to well-understood software that does exactly what it has been programmed to do, but here, even with system prompts, there is a confused deputy consideration wherein we introduce risk through a breakdown of the instruction vs. context boundary.
Content breadth + agency = a dizzying array of potential outcomes. In an unconstrained context, the consequences of indirect prompt injection alone via agents’ access to emails, file stores, a cornucopia of APIs, and web content are only limited by the imagination.
With that distinction we can start building agentic supply chain security using familiar principles in new ways with MCP gateways, prompt input and output validation, restricting agent privileges, and allowlisting trusted data sources.
This is only the beginning, but we have the foundation to leverage time-tested security principles in an evolving threat landscape to engineer purpose-built solutions, just as we always have.
Recommendations
If you are looking for guidance on securing agentic deployments, follow the below recommendations to get started:
- (Continue to) Harden the Software Supply Chain: Leverage SCA, IaC, and container image scanning and enforce signed/verified artifacts
- Constrain Agent Capabilities: Allowlist tools/actions per agent identity and enforce policy-based execution checks (e.g.: AWS Cedar, OPA) that permit only approved actions on specific targets, and require human approval for high-impact actions
- Gate Tool and Data Access: Leverage MCP gateway/proxy technology to log every request/response, enforce least privilege scopes, and allowlist domains/APIs
- Secure Non-Human Identities: Inventory all NHIs, review privileges/permissions, log their actions, and alert on anomalous behavior (novel activity, volume spikes, unusual hours, etc.)
- Eliminate NHI Standing Privilege: Leverage JIT & JEA principles with short-lived tokens via modern PAM tooling to limit persistent access
- Validate Inputs & Outputs: Use guardrails (e.g.: AWS Bedrock or Microsoft Foundry) for prompt injection, PII, and other safety checks in inputs and outputs
- Segmentation/Isolation: Where feasible, segment agent environments to limit lateral movement in the event of a compromise
[1]https://www.koi.ai/blog/darkspectre-unmasking-the-threat-actor-behind-7-8-million-infected-browsers